d16a5ee9698a4c4bda5bb92bb037c09d7f2b8c80f94905d2cdb743e13aba41e9

Sharing

Copy URL Twitter E-mail

General

Target

d16a5ee9698a4c4bda5bb92bb037c09d7f2b8c80f94905d2cdb743e13aba41e9
Size

789KB
MD5

d455fb259f57200365e281bd8eaa47dd
SHA1

8e1f0f0902065760448a8c20ea8c52e03399dde3
SHA256

d16a5ee9698a4c4bda5bb92bb037c09d7f2b8c80f94905d2cdb743e13aba41e9
SHA512

134775319985a1185125c7c16a83b9b257076839076e103cd558bbc660c66dba8ce7881e02f560a0f317876a83e97a8093c8ca0d57ecfa067160daa2ddfa3838
SSDEEP

12288:qrtKU5Nk7yK6+X/P6+X/6YCoPsk7vFIlv:SpEyFg/yg/6YCUsk7vFG

Score

1^/10

Malware Config

Signatures

Files

d16a5ee9698a4c4bda5bb92bb037c09d7f2b8c80f94905d2cdb743e13aba41e9
.exe windows x64

a0ad82b564665412272991ba09f43857

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
TraceEvent
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegQueryValueExW

kernel32

GlobalUnlock
GlobalLock
GlobalAlloc
LockResource
FindResourceW
RegisterApplicationRestart
HeapSetInformation
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameW
FindResourceExW
LoadResource
SizeofResource
EnterCriticalSection
MultiByteToWideChar
LeaveCriticalSection
MulDiv
GetUserDefaultUILanguage
GetLocaleInfoW
OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
ExpandEnvironmentStringsW
GetLastError
GetLocaleInfoEx
Sleep
SetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
lstrcmpiW
RaiseException

gdi32

CreatePen
SetBkMode
SetBkColor
CreateFontIndirectW
GetTextMetricsW
GetTextExtentPoint32W
GetDeviceCaps
GetObjectW
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
StretchBlt
DeleteObject
DeleteDC
Rectangle
GetStockObject
SetDCPenColor
SetTextColor
CreateDIBSection
GdiAlphaBlend
GetDIBits
SetDIBits
CreateSolidBrush

user32

UnionRect
SetTimer
GetWindowRect
FillRect
LoadImageW
DrawTextW
KillTimer
UnregisterClassA
ord2560
ScreenToClient
SetForegroundWindow
MessageBoxW
PostQuitMessage
SendDlgItemMessageW
GetClientRect
CopyImage
DrawTextExW
LoadIconW
SetClassLongPtrW
SystemParametersInfoW
SetDlgItemTextW
EnableWindow
MoveWindow
SetRectEmpty
PtInRect
InflateRect
GetDlgItem
GetDC
ReleaseDC
SendMessageW
SetWindowLongPtrW
SetWindowLongW
GetParent
ShowWindow
GetSysColor
CreateWindowExW
DestroyWindow
PostMessageW
BeginPaint
IsWindowVisible
EndPaint
InvalidateRect
GetWindowLongW
OffsetRect
CopyRect
GetDlgItemTextW
SetRect
GetWindowLongPtrW
CallWindowProcW
GetPointerInfo
GetPointerInfoHistory
CharNextW
FlashWindowEx
GetCaretBlinkTime
LoadStringW
FindWindowW

msvcrt

_wcmdln
_fmode
_commode
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_errno
realloc
_lock
_initterm
__dllonexit
_onexit
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_vsnwprintf
__CxxFrameHandler3
_CxxThrowException
atan2
memcpy
__C_specific_handler
memset
memcpy_s
wcsncpy_s
??_U@YAPEAX_K@Z
??2@YAPEAX_K@Z
malloc
_purecall
??_V@YAXPEAX@Z
??3@YAXPEAX@Z
_unlock
sqrt
free

ntdll

WinSqmIsOptedIn
WinSqmIncrementDWORD
RtlVirtualUnwind
RtlLookupFunctionEntry
EtwTraceMessage
RtlCaptureContext

gdiplus

GdipBitmapLockBits
GdiplusShutdown
GdipBitmapUnlockBits
GdipGetImageHeight
GdipGetImageWidth
GdipImageRotateFlip
GdipDisposeImage
GdipCloneImage
GdipAlloc
GdipFree
GdiplusStartup
GdipCreateBitmapFromStream

comctl32

CreatePropertySheetPageW
PropertySheetW

shlwapi

PathFileExistsW

shell32

SHGetSpecialFolderPathW
ShellExecuteW

ole32

CoUninitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CreateStreamOnHGlobal
CoInitialize

oleaut32

VarUI4FromStr

Sections

.text
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 671KB - Virtual size: 671KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a0ad82b564665412272991ba09f43857

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

gdiplus

comctl32

shlwapi

shell32

ole32

oleaut32

Sections

.text Size: 101KB - Virtual size: 100KB

.data Size: 1KB - Virtual size: 3KB

.pdata Size: 3KB - Virtual size: 3KB

.idata Size: 8KB - Virtual size: 7KB

.rsrc Size: 671KB - Virtual size: 671KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 101KB - Virtual size: 100KB

.data
Size: 1KB - Virtual size: 3KB

.pdata
Size: 3KB - Virtual size: 3KB

.idata
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 671KB - Virtual size: 671KB

.reloc
Size: 2KB - Virtual size: 2KB